Government is the least exposed sector we measure and 76.3% of 279 public bodies in 36 countries are still exposed, with 439 ChatGPT and 190 Okta logins among the records. Which countries’ public bodies are cleanest, why the sector is still the second most attacked, and what to check.
Browsing: Stealer Logs
Coverage of infostealers, credential markets, and the stealer-log economy.
One infected laptop gives up every saved password. Inside the stealer logs of 707 large companies: 13,380 Salesforce logins, 4,438 Okta logins, 2,928 GitHub logins, 942 AWS consoles and the dashboards of the security tools meant to stop it.
295 universities in 36 countries, 99.3% exposed, a median of 127 stolen logins each, and half of all new stolen employee credentials in the month. Why students make campuses the softest target, what the logins open, and what to do about it.
98.6% of large US organisations have an employee login in stealer logs. Estonia is at 67.7%. We rank all 36 countries in the Ransomnews panel by stolen employee credentials, show where exposure is growing fastest right now, and link a data page for each.
Lumma now leads the infostealer ecosystem in 2026, after Operation Magnus took out RedLine and META in late 2024. RedLine’s…
A stealer log is the data dump that an infostealer malware produces after it compromises a device. It typically contains…
Through 2024 and 2025 a quiet rebalancing happened: password-phishing fell, session-cookie theft via infostealers surged, and “we have MFA” stopped meaning what defenders thought it meant. A 2026 field guide to the technique and the controls that actually answer it.
A 2026 walkthrough of the typical infostealer-log archive: what files it contains, what each one means, and how defenders parse them with Python and jq for downstream incident response.
A practitioner’s tutorial for checking whether your email, your domain, or your employees show up in fresh infostealer logs, using Hudson Rock’s free tools, IntelX, Have I Been Pwned, and a couple of paid options worth the spend.
A 2026 tutorial on building a layered defence against infostealers: endpoint EDR settings that catch stealer behaviour, browser hardening that protects cookie stores, and the user-side training that closes the actual gap.